ClawHub
Back to skill

Security audit

Webhook Robot

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple webhook messaging utility, but it should be reviewed because it can send user-provided content and credentials to many external or custom endpoints with limited scoping and incomplete disclosure in the main skill instructions.

Install only if you are comfortable with an agent sending selected message content to external bot and notification services. Treat all webhook keys, bot tokens, secrets, chat IDs, and full webhook URLs as sensitive, avoid sending confidential or regulated content, and prefer tightly controlled destination URLs until the skill adds clearer platform disclosure, credential handling, and network allowlisting.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/send_dingtalk.py:52
Finding

Sensitive credentials exposed through command-line arguments

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/send_feishu.py:10
Finding

Unrestricted webhook destinations permit server-side request forgery and credential disclosure

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/send_bark.py:5
Finding

Credentials and message content placed in request URLs may leak through logs

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (26)

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · README.md (reported line 3)May include surrounding context.

md
---
name: webhook-robot
description: A universal skill to send messages to webhook-based chat bots.
metadata: { "openclaw": { "emoji": "🤖", "requires": { "bins": ["python3"] } } }
---

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · README.md (reported line 14)May include surrounding context.

md
---
name: webhook-robot
description: A universal skill to send messages to webhook-based chat bots.
metadata: { "openclaw": { "emoji": "🤖", "requires": { "bins": ["python3"] } } }
---

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md
---
name: webhook-robot
description: A universal skill to send messages to webhook-based chat bots.
metadata: { "openclaw": { "emoji": "🤖", "requires": { "bins": ["python3"] } } }
---

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · package.json (reported line 4)May include surrounding context.

json
---
name: webhook-robot
description: A universal skill to send messages to webhook-based chat bots.
metadata: { "openclaw": { "emoji": "🤖", "requires": { "bins": ["python3"] } } }
---

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The description claims support for various webhook bots including DingTalk and Feishu, while the body states only WeCom is currently supported. This is a real description-behavior mismatch that can mislead users about where data will go and what interfaces are available, reducing informed consent and trust.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The description claims support for various webhook bots including DingTalk and Feishu, while the body states only WeCom is currently supported. This is a real description-behavior mismatch that can mislead users about where data will go and what interfaces are available, reducing informed consent and trust.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The description claims support for various webhook bots including DingTalk and Feishu, while the body states only WeCom is currently supported. This is a real description-behavior mismatch that can mislead users about where data will go and what interfaces are available, reducing informed consent and trust.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The description claims support for various webhook bots including DingTalk and Feishu, while the body states only WeCom is currently supported. This is a real description-behavior mismatch that can mislead users about where data will go and what interfaces are available, reducing informed consent and trust.

Content

No source excerpt is available for this finding.

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: webhook-robot
description: Send messages to various webhook-based bots (WeCom, DingTalk, Feishu, etc.).
metadata: { "openclaw": { "emoji": "🤖", "requires": { "bins": ["python3"] } } }
---

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/send_dingtalk.py (reported line 52)May include surrounding context.

python
if __name__ == "__main__":
    parser = argparse.ArgumentParser(description='Send message to DingTalk Robot')
    parser.add_argument('--token', required=True, help='DingTalk access token')
    parser.add_argument('--secret', help='DingTalk secret (optional, for security)')
    parser.add_argument('--content', required=True, help='Text/Markdown content to send')
    parser.add_argument('--markdown', action='store_true', help='Send as Markdown')

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · scripts/send_bark.py (reported line 35)May include surrounding context.

python
sys.exit(1)

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description='Send message to ServerChan (Turbo)')
    parser.add_argument('--key', required=True, help='SendKey')
    parser.add_argument('--title', required=True, help='Message title')
    parser.add_argument('--content', required=True, help='Message content (Markdown supported)')

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · scripts/send_dingtalk.py (reported line 51)May include surrounding context.

python
sys.exit(1)

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description='Send message to ServerChan (Turbo)')
    parser.add_argument('--key', required=True, help='SendKey')
    parser.add_argument('--title', required=True, help='Message title')
    parser.add_argument('--content', required=True, help='Message content (Markdown supported)')

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · scripts/send_feishu.py (reported line 45)May include surrounding context.

python
sys.exit(1)

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description='Send message to ServerChan (Turbo)')
    parser.add_argument('--key', required=True, help='SendKey')
    parser.add_argument('--title', required=True, help='Message title')
    parser.add_argument('--content', required=True, help='Message content (Markdown supported)')

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · scripts/send_gotify.py (reported line 38)May include surrounding context.

python
sys.exit(1)

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description='Send message to ServerChan (Turbo)')
    parser.add_argument('--key', required=True, help='SendKey')
    parser.add_argument('--title', required=True, help='Message title')
    parser.add_argument('--content', required=True, help='Message content (Markdown supported)')

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · scripts/send_pushdeer.py (reported line 31)May include surrounding context.

python
sys.exit(1)

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description='Send message to ServerChan (Turbo)')
    parser.add_argument('--key', required=True, help='SendKey')
    parser.add_argument('--title', required=True, help='Message title')
    parser.add_argument('--content', required=True, help='Message content (Markdown supported)')

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · scripts/send_serverchan.py (reported line 26)May include surrounding context.

python
sys.exit(1)

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description='Send message to ServerChan (Turbo)')
    parser.add_argument('--key', required=True, help='SendKey')
    parser.add_argument('--title', required=True, help='Message title')
    parser.add_argument('--content', required=True, help='Message content (Markdown supported)')

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · scripts/send_telegram.py (reported line 28)May include surrounding context.

python
sys.exit(1)

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description='Send message to ServerChan (Turbo)')
    parser.add_argument('--key', required=True, help='SendKey')
    parser.add_argument('--title', required=True, help='Message title')
    parser.add_argument('--content', required=True, help='Message content (Markdown supported)')

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · scripts/send_wecom.py (reported line 42)May include surrounding context.

python
sys.exit(1)

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description='Send message to ServerChan (Turbo)')
    parser.add_argument('--key', required=True, help='SendKey')
    parser.add_argument('--title', required=True, help='Message title')
    parser.add_argument('--content', required=True, help='Message content (Markdown supported)')

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README explicitly positions the skill as a mechanism to send data to third-party webhook and bot endpoints, but it provides no warning that message content will leave the local environment and may include sensitive data. In an agent ecosystem, that omission increases the chance that users or downstream agents transmit secrets, internal prompts, or proprietary content to external services without informed consent.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill clearly performs outbound network actions by sending data to webhooks, but the manifest does not declare any tool scope or permissions for network use. This weakens transparency and policy enforcement, making it easier for a skill to transmit data externally without explicit approval or user awareness.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/send_bark.py (reported line 7)May include surrounding context.

python
def send_bark_msg(key, title, content, url=None, group=None):
    # Construct base URL
    # Format: https://api.day.app/{key}/{title}/{body}?url=...&group=...
    base_url = f"https://api.day.app/{key}/"
    
    # URL encode title and content

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/send_bark.py (reported line 8)May include surrounding context.

python
def send_bark_msg(key, title, content, url=None, group=None):
    # Construct base URL
    # Format: https://api.day.app/{key}/{title}/{body}?url=...&group=...
    base_url = f"https://api.day.app/{key}/"
    
    # URL encode title and content

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This script adds GoCqHttp/OneBot messaging capability, which is broader than the declared scope of sending to webhook-based bots such as WeCom, DingTalk, and Feishu. That scope mismatch is security-relevant because it introduces an undeclared outbound communication channel that could be used to send data or instructions to QQ/OneBot targets outside expected review boundaries.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill manifest scopes the capability to 'various webhook-based bots' and gives examples that are webhook integrations such as WeCom, DingTalk, and Feishu. This file instead implements Telegram bot messaging via the Telegram Bot API endpoint, which is a different integration model and expands behavior beyond the manifest's stated examples and framing.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/send_telegram.py (reported line 7)May include surrounding context.

python
import sys

def send_telegram_msg(token, chat_id, content, markdown=False):
    url = f"https://api.telegram.org/bot{token}/sendMessage"
    headers = {'Content-Type': 'application/json'}
    
    data = {

Static analysis

No suspicious patterns detected.